ACL sanity check

[Brendan Kearney <bpk678@gmail.com>]

i am looking to improve my access controls, and wanted to make sure the 
below passes muster and sanely implements what i am looking for.

0 - ldap admins get access to the entire directory
{0}to dn.subtree="dc=bpk2,dc=com"
        by 
group.exact="cn=ldapAdmins,ou=domainGroups,ou=Groups,dc=bpk2,dc=com" manage
        by anonymous auth
        by * none

1 - kerberos id get only the access they need
{1}to dn.subtree="cn=BPK2.COM,dc=bpk2,dc=com"
        by dn="cn=kadmin,dc=bpk2,dc=com" write
        by dn="cn=kdc,dc=bpk2,dc=com" read
        by * none

2 - dns engineers, admins and dns process accounts get access
{2}to dn.subtree="cn=dns,ou=Daemons,dc=bpk2,dc=com"
        by 
group.exact="cn=dnsEngineers,ou=domainGroups,ou=Groups,dc=bpk2,dc=com" 
manage
        by 
group.exact="cn=dnsAdmins,ou=domainGroups,ou=Groups,dc=bpk2,dc=com" write
        by 
group.exact="cn=dnsProcesses,ou=processGroups,ou=Groups,dc=bpk2,dc=com" 
write
        by * none

3 - dhcp engineers, admins and dhcp process accounts get access
{3}to dn.subtree="cn=DHCP Config,ou=Daemons,dc=bpk2,dc=com"
        by 
group.exact="cn=dhcpEngineers,ou=domainGroups,ou=Groups,dc=bpk2,dc=com" 
manage
        by 
group.exact="cn=dhcpAdmins,ou=domainGroups,ou=Groups,dc=bpk2,dc=com" write
        by 
group.exact="cn=dhcpProcesses,ou=processGroups,ou=Groups,dc=bpk2,dc=com" 
read
        by * none

4 - dhcp engineers, admins and dhcp process accounts get access
{4}to dn.subtree="cn=DHCP Servers,ou=Daemons,dc=bpk2,dc=com"
        by 
group.exact="cn=dhcpEngineers,ou=domainGroups,ou=Groups,dc=bpk2,dc=com" 
manage
        by 
group.exact="cn=dhcpAdmins,ou=domainGroups,ou=Groups,dc=bpk2,dc=com" write
        by 
group.exact="cn=dhcpProcesses,ou=processGroups,ou=Groups,dc=bpk2,dc=com" 
read
        by * none

5 - users can read this ou
{5}to dn.subtree="ou=Computers,dc=bpk2,dc=com"
        by users read
        by * none

6 - users can read this ou
{6}to dn.subtree="ou=Groups,dc=bpk2,dc=com"
        by users read
        by * none

7 - users can read this ou
{7}to dn.subtree="ou=Networks,dc=bpk2,dc=com"
        by users read
        by * none

8 - users can read this ou
{8}to dn.subtree="ou=Users,dc=bpk2,dc=com"
        by users read
        by * none

are there any specific ACLs that i should have?  are there any glaring 
issues with the above proposed ACLs?